Medical records privacy rules finalized The AMAnews summarized nicely the major changes just announced:

Key changes in the final medical records privacy rule:

* Health care professionals must obtain an individual's prior written permission to use protected information for marketing purposes or to sell the information to third parties.
* Health care professionals must disclose their privacy policies and inform patients of their privacy rights; physicians must make a good-faith effort to obtain a patient's written acknowledgement.
* Incidental uses or disclosures are not considered violations if reasonable safeguards are in place.
* The deadline to change existing written contracts to prevent disclosure of protected information by business associates is extended for one year.
* Authorization for use of data for research purposes is streamlined.